On Tuesday something very strange happened and I haven't been able to definitively work out how.
I returned to the LastPass app on my iPhone where I'd been using the builtin browser. It's pretty clean since I only use it for sites where I log in directly from the 'Vault'.
The first mystery: on re-opening the browser, a page titled "PlayOGame" was loading in the foreground tab advertising some games.
A web page signed up my mobile number to a premium rate subscription
Immediately after page load (and I don't believe I clicked on this page), I received an SMS saying "You have subscribed to PLAYOGAME...".
EE couldn't tell me how it works
I phoned my provider - EE in the UK - who told me I had subscribed to this service by clicking on a link.
I asked how the company got my number (e.g. how EE gave it to them) - and he replied confidently "it's the way internet works - websites can get your number through your data signal" ... (lol) ... which wasn't quite how I understood things...
The ad company couldn't tell me how it works
I got a similarly confused answer from Payguru, the company I had 'subscribed' to (who apparently hadn't heard of PlayOGame but were able to unsubscribe me). She told me that "98% of links on the internet are chargeable". Right.
I did manage to learn the payment mechanism is called "direct carrier billing" and that "one click on a website is sufficient to authorize payment"
The premium rate number REGULATOR couldn't tell me how it works
Finally I complained to the Phone-paid Services Authority - the UK regulator - who patiently recorded my complaint, but had no idea what I was talking about.
Is EE doing 'header enrichment'?
My first thought was this was like when O2 were 'accidentally' adding users' MSISDNs to every HTTP request.
I've subsequently learned this is called 'header enrichment' (implying this perhaps wasn't an accident). There are shady-looking forums talking about this alongside "one-click payment flows" and "msisdn recognition".
I inspected my outgoing HTTP headers in a requestbin and couldn't see any unusual headers. I tried the same with cookies using httpbin.org/cookies but nothing strange there either.
I found a couple of papers on this:
- Privacy Leaks in Mobile Phone Internet Access
- Header Enrichment or ISP Enrichment? Emerging Privacy Threats in Mobile Networks
In both papers they were able to detect these headers on their own webservers, but I am not... why not?
Could it be that EE are selectively sending headers only to advertisers, to make it harder to detect this behaviour? Is there another method I haven't thought of?
Does anyone have any insight on how this works?
In the mobile space delivering the right ad to the right person is difficult because there is no common standard for identity and addressability. We think we’re in a position to solve that. The second piece is the measurement of mobile; there are a lot of problems with getting good attribution data.
C. Hillier, VP of Verizon’s Precision Market Insights division
Edit: Update: PlayOGame's website
I found PlayOGame's website (visit with care! http://playogame.center) in LastPass's history (duh).
They're a company called AKMobile in Azerbaijan:
Organization: AKMobile LLC Street: Khojali Avenue, Baku, Azerbaijan City: Baku State/Province: Baku Postal Code: AZ1025 Country: AZ
Like many site operators, we collect information that your browser sends whenever you visit our Site ("Log Data").
This Log Data may include information such as your mobile number (MSISDN), browser type, browser version, the pages of our Site that you visit, the time and date of your visit, the time spent on those pages and other statistics.